CVE-2026-117541 svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

Medium 6.9 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-117541?

CVE-2026-117541 is a medium-severity vulnerability in darylldoyle svg-sanitizer, published on 27 Oct 2026.

Official description

svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.

Weakness: CWE-248

Which versions are affected by CVE-2026-117541?

How do I fix CVE-2026-117541?

No fix has been published for CVE-2026-117541 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117541 being exploited?

There is no known exploitation of CVE-2026-117541 in the wild and no public exploit code.

Sources

Also known as GHSA-82gx-99vw-x254, GHSA-cgcm-4g72-hfgw.